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Preface 

The Department of Homeland Security (DHS) Office of Inspector General (OIG) was established 
by the Homeland Security Act of 2002 {Public Law 107-296) by amendment to the Inspector 
General Act of 1978. This is one of a series of audit, inspection, investigative, and special reports 
prepared by the OIG as part of its DHS oversight responsibility to identify and prevent fraud, 
waste, abuse, and mismanagement. 




This report assesses the strengths and weaknesses of the program or operation under review. It 
is based on interviews with employees and officials of relevant agencies and institutions, direct 
observations, and a review of applicable documents. 



The recommendations herein, if any, have been developed to the best knowledge available to the 
OIG, and have been discussed in draft with those responsible for implementation. It is my hope 
that this report will result in more effective, efficient, and-economical operations. I express my 
appreciation to all of those who contributed to the preparation of this report. 
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OIG 



Department of Homeland Security 
Office of Inspector General 



Introduction 

The Office of Inspector General (OIG), at the request of Congressman Jim Turner, 
ranking member of the House Select Committee on Homeland Security, reviewed 
allegations that the Transportation Security Administration (TSA) was conducting 
a "witch hunt" to ferret out and discipline employees in the federal air marshal 
program who talked to the media about a TSA decision to remove air marshals 
from certain long distance flights to save overnight lodging costs. The allegations 
included a charge that some air marshals had been threatened with having the 
USA PATRIOT Act 1 used against them. 

The objectives of the audit were to determine whether employees in the federal air 
marshal program, as a result of disclosing sensitive information to the press, the 
Congress, or the public: 

• Have been investigated, and if so, under what authority; 

• Have suffered retaliation or were threatened with retaliation; or 

• Have had actions taken or threatened against them under authority of the 
USA PATRIOT Act. 

We performed audit fieldwork from November 2003 to March 2004. We 
interviewed TSA and Federal Air Marshal Service (FAMS) officials at 
headquarters, System Operation Control Division, and Human Resource 
Management Branch. We visited 8 of 21 FAMS field offices and interviewed 
Special Agents in Charge (SAC), Assistant Special Agents in Charge (ASAC), and 
157 air marshals at these locations. 



1 Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act; Public Law 107-56 
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Results in Brief 



The FAMS and TSA conducted nine investigations of air marshals for allegedly 
talking to the press or public. These investigations, and actions taken by 
FAMS and TSA against air marshals as a result of these investigations, were 
appropriate under the circumstances. We found no evidence that air marshals 
were investigated or retaliated against for talking to Congress, or were threatened 
with or had action taken against them under authority of the USA PATRIOT 
Act. However, air marshals from two locations said that they were threatened 
with arrest and prosecution if they were found to have released sensitive security 
information (SSI), even though release of SSI is not a prosecutable offense. TSA, 
Immigration and Customs Enforcement (ICE), and FAMS provided technical 
comments on a draft of this report, which we incorporated where appropriate. 

Background 

The Aviation and Transportation Security Act empowered TSA to deploy air 
marshals on all passenger airline flights. It required that TSA deploy air marshals 
on all high-risk flights and give priority to long distance non-stop flights, such as 
those used on September 11, 2001, when determining risk. 

On July 30, 2003, two articles discussing FAMS issues appeared on the MSNBC 
website, an online news service. The first article alleged that TSA planned to 
remove air marshals from some long distance flights because of budget shortfalls, 
leaving many high-risk flights unprotected. A second article later that day 
reported that TSA reversed the decision to remove the air marshals. 

The FAMS' plan to limit air marshal missions on cross-country and international 
flights was the result of reprogramming actions by TSA. According to a 
Government Accountability Office report, reprogramming actions reduced FY 
2003 FAMS program funding from $545 million to approximately $450 million, 
a difference of $95 million. 2 While the GAO report concluded that the impact 
of the budget reduction on FAMS operations was not as significant as FAMS 
officials estimated, FAMS officials thought the reduction in cross country and 
international flights was necessary to meet budgetary requirements. The FAMS 
Director began to reduce scheduled air marshal coverage on cross-country and 
international flights at the end of July 2003, to be effective August 3, 2003. On 



2 Government Accountability Office report number GAO-04-577R, Air Marshal Reprogramming 
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July 30, 2003, the scheduled reduction was reported on the MSNBC website. On 
July 31, 2003, TSA allocated an additional $9 million to the FAMS and the full 
schedule of cross-country and international flights was resumed. 

There was a temporary decline in the number of flights that air marshals flew 
beginning on August 1, 2003. Flights decreased by as much as 17% before 
returning to normal on August 6, 2003. Although the air marshal schedule was 
reinstated prior to August 2, previously scheduled flights could not be restored 
due to the complexity of the scheduling process. 

The FAMS Director sent memoranda to all FAMS employees on July 30 and 
August 1, 2003, concerning disclosure of sensitive information. In his first 
memorandum, the FAMS Director said that each air marshal had a critical role 
to play to ensure operational integrity and that public discussion of strategic 
deployment of air marshals was not in the best interest of operational security. In 
his second memorandum, the Director said that some air marshals had chosen to 
disclose and disseminate sensitive information, which was a violation of FAMS 
policy. He also said that this conduct could jeopardize the FAMS mission, FAMS 
personnel, and the security of our country. According to the memorandum, the 
policy would be strictly enforced. 

SACs were instructed to make sure that all air marshals received, read, and 
understood the second memorandum relating to FAMS policies on the release 
of SSI and classified information. At all field offices that we visited, the SAC, 
ASAC, or a front line supervisor had addressed air marshals about operational 
security. Some field offices required the air marshals sign a document attesting to 
the fact that they had read and understood the memorandum's contents. 

On August 21, 2003, a third MSNBC article reported that TSA was conducting a 
"witch hunt" to ferret out and discipline employees in the FAMS who had talked 
to the media. This article further alleged that air marshals were told that TSA 
planned to use the USA PATRIOT Act authority to determine who talked to the 
media. 

Congress passed the USA PATRIOT Act following the September 11, 2001, 
terrorist attacks. The law gave federal officials greater authority to track and 
intercept communications for law enforcement and foreign intelligence gathering 
purposes. It provided enhanced surveillance procedures in order to counter 
terrorism. 
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In November 2003, FAMS was transferred from TSA to ICE. Department 
officials said that the move increased DHS' ability to respond to air security 
threats by creating a larger number of trained federal agents who can respond 
during times of crisis. 

FAMS and TSA Investigations of Air Marshals 

FAMS conducted seven investigations and TSA conducted two investigations of 
air marshals for allegedly disclosing sensitive information to the press or public. 
There were no investigations of air marshals for allegedly disclosing information 
to the Congress. FAMS policy prohibits the disclosure of information concerning 
the FAMS, TSA, or Department of Transportation (DOT) to the press without the 
permission of the FAMS Director. 3 This policy also restricts the disclosure of SSI, 
which includes information concerning the number of air marshals, air marshal 
deployments or missions, and the methods involved in FAMS operations. The 
nine investigations are discussed below. 

FAMS Investigations 

Two air marshal investigations concerned the release of information to a third 
party, and were resolved with counseling. Two other investigations concerned 
air marshals disclosing their identities while on missions. One of these cases 
was resolved by counseling, and the other resulted in a suspension because it 
was a second offense. The other three investigations resulted in air marshals 
being terminated, resigning, or being placed on administrative leave. They are 
discussed below. 

• An air marshal was terminated for divulging SSI in a newspaper 
article. The air marshal disclosed specific information about operations, 
including flight seat location, work schedule, workforce size, and a 
description of training equipment. The article also included the air 
marshal's picture. 

• An air marshal was investigated for providing an article for a 
professional association newsletter without obtaining prior authorization. 
The association is comprised of law enforcement personnel, firefighters, 



3 According to FAM Administrative Directive Manual 3700, Employee Responsibility and Conduct, "Only the Director FAMS, or his 
designee, may authorize any public statements concerning the FAMS, TSA, or DOT. Unless designated by the Director FAMS, employees 
shall not address public gatherings, appear on radio or television, prepare any articles for publication, act as correspondents to a newspaper 
or periodical, release or divulge investigative information or any other matters pertaining to the FAMS, TSA, or DOT." 
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military personnel, and other related professionals. The air marshal 
resigned before the investigation was completed. 

• An air marshal was investigated for participating in an unofficial internet 
website. The air marshal allegedly made disparaging statements about 
the SAC. The air marshal was placed on administrative leave and was 
ultimately returned to normal duties. 

TSA Investigations 

Two TSA Office of Internal Affairs investigations involved air marshals allegedly 
disclosing SSI. The first case involved a FAMS employee, not an air marshal, 
who was believed to have disclosed SSI to a reporter for MSNBC. This employee 
resigned prior to the completion of the investigation and the case was closed. 

The second investigation involved a person, believed to be an air marshal, 
who may have disclosed SSI on an unofficial internet website. Participation in 
any such unofficial internet websites is against FAMS policy. TSA focused its 
investigation, however, only on air marshals who posted SSI on the website. 
There were two incidents where someone, using an internet alias, had disclosed 
SSI on an internet website. TSA was unable to determine the person's identity 
and the case was closed. 

According to FAMS policy, employees are prohibited from releasing sensitive 
or classified information unless authorized by the FAMS Classified Documents 
Custodian. Violators of this policy are subject to disciplinary action. Air 
marshals are required to sign a statement annually that requires them not to 
disclose SSI. 

Federal regulations 4 prohibit disclosure of sensitive information obtained or 
developed in carrying out security activities. According to the regulations, SSI 
includes security directives and information circulars, information that may reveal 
a systemic vulnerability of the aviation system, and specific details of aviation 
security measures. This included the numbers of air marshals, their deployments 
or missions, and the methods involved in FAMS operations. 

The actions taken by FAMS and TSA in the nine cases discussed above were 
consistent with current guidelines and regulations. Section 17. a. of TSA's 



4 Title 49 Code of Federal Regulation, Part 1520 



TSA - Federal Air Marshals - OIG-05-01 



Page 7 



directive on Employee Responsibilities and Conduct instructs employees not 
to ". . .criticize or ridicule FAMS, TSA, or DOT policy or other employees by 
speech, writing or other expressions that is defamatory, obscene, unlawful, 
impairs the operation or efficiency of the FAMS, TSA, or DOT, or is made with 
reckless disregard for the truth." Section 5.b.5. of the directive warns that ". . . 
violation of this directive. . .may be cause for appropriate corrective or disciplinary 
action in addition to any action or penalty prescribed by law." 

Retaliation or Threats of Retaliation 

We interviewed 157 air marshals, 120 of whom did not believe that FAMS 
management had threatened them, and seven of whom refused to comment on this 
issue. The remaining 30 air marshals believed they had been threatened about 
disclosing information to the press or public. Many of those 30 air marshals 
provided no details on alleged threats, other than saying that FAMS management 
said they would take action against anyone found to be disclosing information 
improperly. FAMS policy prohibits the disclosure of SSI and is punishable 
by disciplinary actions. Disclosure of SSI is also a violation of 49 CFR and is 
punishable by civil penalty and other enforcement or corrective actions. 

Five air marshals, from two field offices, said they were threatened with 
prosecution for disclosing information to the press or public. They said their 
supervisors' threats included being led away in handcuffs, being fired and 
prosecuted, or being subjected to polygraph exams if the leaks continued. 
Neither FAMS policy nor current regulations mention criminal penalties for 
leaking SSI. However, according to the FAMS policy, employees who release 
classified information or records in any form without authority from the Classified 
Documents Custodian are in violation of United States Code and are subject to 
arrest and prosecution. 5 While the alleged threats made to the air marshals may 
have been excessive, based on current guidelines, it should be noted that some 
information considered SSI prior to September 11, 2001, is now being classified 
as secret. 

We found no evidence that TSA or FAMS had taken or threatened to take any 
action against any air marshal under authority of the USA PATRIOT Act. 



5 We question the legal accuracy of this policy statement, which seems to criminalize all releases of classified information. However, 
analyzing the FAMS Directives System is outside the scope of this audit. 
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Appendix A 

Purpose, Scope, and Methodology 



Purpose, Scope, and Methodology 

At the request of Congressman Jim Turner, ranking member of the House 
of Representatives, Select Committee on Homeland Security, we reviewed 
allegations that TSA was conducting a "witch hunt" to ferret out and discipline 
employees in the federal air marshal program who have talked to the media. The 
allegations include a charge that some air marshals have been threatened with 
having the USA PATRIOT Act used against them. The objectives of the audit 
were to determine whether FAMS employees, as a result of disclosing sensitive 
information to the press, the Congress, or the public: 

• Have been investigated, and if so, under what authority; 

• Have suffered retaliation or were threatened with retaliation; or 

• Have had actions taken or threatened against them under authority of the 
USA PATRIOT Act. 

We interviewed TSA and FAMS officials at headquarters, the System Operation 
Control Division in Virginia, and the Human Resource Management Branch in 
New Jersey. We also visited 8 of 21 FAMS field offices where we interviewed 
SACs, ASACs, and 157 air marshals. 

We reviewed FAMS conduct incident reports from March 2002 through 
December 2003, internal investigation reports, TSA records of congressional 
correspondence, budget requests, budget planning documents, and actual 
expenditures for FY 2003. 

The audit fieldwork was performed between November 2003 and March 2004. 
We conducted this review pursuant to the Inspector General Act of 1978, as 
amended, and according to generally accepted government auditing standards. 
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Appendix B 

Major Contributors to this Report 



Roberta N. Rickey, Field Audit Director 
Bradley Mosher, Audit Manager 
Larry Fugate, Auditor-in-Charge 
Gary Wilk, Auditor 
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Appendix C 
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Office of Management and Budget 
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Additional Information and Copies 

To obtain additional copies of this report, call the Office of Inspector General (OIG) at 
(202) 254-4100, fax your request to (202) 254-4285, or visit the OIG web site at 
www.dhs.gov/oig. 

OIG Hotline 

To report alleged fraud, waste, abuse or mismanagement, or any other kind of criminal 
or noncriminal misconduct relative to department programs or operations, call the OIG 
Hotline at 1-800-323-8603; write to Department of Homeland Security, Washington, DC 
20528, Attn: Office of Inspector General, Investigations Division - Hotline. The OIG 
seeks to protect the identity of each writer and caller. 



